Reject project CI jobs on reserved policy stages

What does this MR do and why?

This rejects project CI jobs on reserved policy stages.

When using custom security policy scan jobs we add stages that are reserved for security policy jobs only. To protect those stages we remove any jobs that are added before the custom scan actions get merged with the CI config.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

1. Create a group.
2. Go to Settings -> General.
3. Toggle the Permissions and group features section.
4. Enable Security policy pipeline execution action.
5. Create a project
6. Add a .gitlab-ci.yml file with content:

   stages:
       - .pipeline-policy-test
   
   project_job:
       stage: .pipeline-policy-test
       script:
           - echo "Hello World"

7. Run a pipeline. It should contain the project_job.
8. On the left sidebar, select Security & Compliance and Policies.
9. Select New Policy.
10. Select Scan execution policy.
11. Switch to .yaml mode and enter the following policy:

    type: scan_execution_policy
    name: test
    description: ''
    enabled: true
    rules:
      - type: pipeline
        branch_type: all
    actions:
      - scan: custom
        ci_configuration: |-
          policy_job:
            stage: .pipeline-policy-test
            script:
              - echo 'Hello World'

12. Select Configure with a merge request.
13. Go back to the project and run a new pipeline.
14. The pipeline should now only contain policy_job

Related to #440141 (closed)